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March 13, 2020 


Mr. Russell T. Vought 

Office of Management and Budget 
725 17" St., NW 

Washington, DC 20503 


VIA ELECTRONIC TRANSMISSION 


RE: Request for Comments on a Draft Memorandum to the Heads of Executive 
Departments and Agencies, “Guidance for Regulation of Artificial Intelligence 
Applications,” (Federal Register Doc. 2020-00261) 


Dear Mr. Vought: 


BSA | The Software Alliance (BSA) appreciates the opportunity to provide comments on the 
Office of Management and Budget’s draft Guidance for the Regulation of Artificial Intelligence 
Applications. BSA is an association of the world’s leading enterprise software companies that 
provide businesses in every sector of the economy with tools to operate more competitively 
and innovate more responsibly.t As companies at the forefront of developing Al-enabled 
solutions, BSA members recognize that trust is essential to the public’s willingness to 
embrace these new technologies. Accordingly, BSA engages with governments around the 
world on the development of policies that both promote innovation and enhance confidence in 
the technologies that are driving economic growth. 


Profound breakthroughs over the past decade have transformed Al from an emerging lab- 
based technology into a commercial reality that is now powering our smartphones, our 
homes, and our businesses. As Al is integrated into a staggering array of products, services, 
and business processes, policymakers around the world are beginning to explore whether 
they have the right policies in place to enhance the benefits of the technology and safeguard 
against its potential risks. OMB’s draft Guidance for the Regulation of Al (Draft Guidance) 
therefore arrives at a timely moment and can help establish global norms around the 
governance of Al. 


We strongly support the vision in the Draft Guidance and agree that US leadership in Al 
“requires a regulatory approach that fosters innovation, growth, and...trust.” We are 


particularly encouraged that the Draft Guidance promotes an approach to Al governance that 


is informed by existing law and recognizes the need for risk-based and context-specific 
considerations of Al. 


1 BSA’s members include: Adobe, Atlassian, Autodesk, Bentley Systems, Box, Cadence, 
CNC/Mastercam, IBM, Informatica, Intel, MathWorks, Microsoft, Okta, Oracle, PTC, Salesforce, 
ServiceNow, Siemens Industry Software Inc., Sitecore, Slack, Splunk, Trend Micro, Trimble Solutions 
Corporation, Twilio, and Workday. 
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Informed by Existing Law: Recognizing that the “broader legal environment already 
applies to Al,” 2 the Draft Guidance directs agencies to evaluate the “adequacy of 
existing regulation at a Federal, State, [and] local level” as part of the process of 
determining whether new regulations are needed.? We agree that promoting trust will 
depend on ensuring that existing legal protections for consumers continue to apply to 
the use of Al. The public must be assured that decisions that would otherwise be 
unlawful should not avoid liability simply because they may now involve the use of an 
Al system. 


Risk-Based: The Draft Guidance acknowledges that public trust in Al will require 
regulatory and non-regulatory actions that are tailored to address risks that “present 
the possibility of unacceptable harm.”* We agree that a risk-based approach to a Al 
governance is critical, because the technology can be used in a range of scenarios 
with vastly different risks. We support the Draft Guidance’s focus on developing 
policy approaches that are commensurate to address the “magnitude and nature” of 
the harms at issue.°® 


Context-Specific: Importantly, the Draft Guidance directs agencies to focus 
policymaking activity on specific “applications” of Al. By focusing on specific uses of 
Al, the Draft Guidance ensures that regulatory efforts will be guided by context- 
specific considerations. That is critical because of the many contexts in which Al is 
already used — and will be used in the future. The Draft Guidance rightly notes, for 
instance, that an analysis of the appropriate approach for “disclosure and 
transparency” must be “context-specific” to allow for a holistic assessment of the 
“potential harms, the magnitude of those harms, the technical state of the art, and the 
potential benefits” associated with the specific application of Al that is being 
evaluated. ® 


The approach to Al governance set out in the Draft Guidance provides a solid foundation for 
a regulatory environment that will promote innovation and enhance public trust. To further 
advance these twin objectives, we offer the following recommendations for OMB’s 
consideration. 


1. 


Emphasize the Linkage Between Regulatory Certainty, Trust and Innovation 


The use of Al is subject to a broad array of existing regulations and consumer protections. 
Ensuring that these policies are sufficiently clear is important both for fostering public 
confidence in Al and for encouraging its adoption. As the Draft Guidance acknowledges, 
there are circumstances where a “lack of regulatory clarity may impede innovation.”’ To 
provide clarity in such circumstances, the Draft Guidance directs agencies to focus on the 
development of non-regulatory approaches, such as the issuance of “policy statements, 


2 Draft Guidance at pg. 4. 


3 Draft Guidance at pg. 11. 


4 Draft Guidance at pg. 4. 


5 Draft Guidance at pg. 4. 


ê Draft Guidance at pg. 6. 


7 Draft Guidance at pg. 7. 
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guidance, or testing and deployment frameworks.”® The Draft Guidance should also 
encourage agencies to update any existing regulations that may create uncertainty (e.g., 
regulations that are outdated or rendered ambiguous by technological innovations). 


Recommendation 1: We recommend that the “Technical Guidance on Rulemaking” 
(Appendix A) section clarify that a Regulatory Impact Analysis undertaken by an 
agency considering potential regulatory action should include an explanation of 
“whether the action is intended to address a market failure (e.g., asymmetric 
information), clarify uncertainty related to existing regulations, or address another 
factor, such as protecting privacy or civil liberties, preventing unlawful discrimination, 
or advancing the United States’ economic and national security.”° 

Recommendation 2: In addition, we recommend that the Draft Guidance require 
agencies to establish formal mechanisms for industry to seek guidance and/or 
request clarification about regulations that may be creating uncertainty around the 
use of Al. Such a mechanism should enable industry to request information about 
how an agency may interpret existing regulations and/or statutory authorities related 
to the use of Al. 


The requirement for agencies to develop “Agency Plans” outlining how they will comply with 
the Draft Guidance is a welcome addition. The Agency Plans are an opportunity for agencies 
to audit their statutory authorities and assess whether existing regulations pose a barrier to 
the adoption of Al. Although the Draft Guidance suggests that agencies may undertake 
“stakeholder engagements” as part of the audit process, there is no clear requirement to do 


so. 


2. 


Recommendation 3: The Draft Guidance should require agencies to undertake a 
public consultation in connection with the development of Agency Plans to identify 
processes, policies, or regulations that may be inhibiting Al adoption or otherwise 
undermining public trust. 


Prioritize International Engagement to Promote US Competitiveness 


US leadership in the development of Al will be possible only if US companies can access 
global markets. Ensuring that the US approach to Al regulation is interoperable with our 
trading partners will therefore be a critical priority in the years ahead. Such engagement has 
already yielded some important early successes. For instance, the Organization for Economic 
Cooperation and Development (OECD) Recommendation on Al represents an important first 
step toward establishing global norms around the governance of Al. Those norms are 
predicated on a risk management-based approach for enhancing the benefits of Al and 
safeguarding against unintended harms. Similarly, the European Commission’s recent White 
Paper on Artificial Intelligence sets out a regulatory vision that shares common conceptual 
foundations as the Draft Guidance. For instance, the White Paper seeks to establish a 


8 Draft Guidance at pg. 7. 


° See Draft Guidance at pg. 11. 
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regulatory framework that is informed by existing law, *° risk-based, + and context-specific. 1 
Global convergence around risk-based Al governance is an international trend that should be 
encouraged. 


e Recommendation 4: The Draft Guidance can lend momentum to these positive 
developments by encouraging agencies to give consideration not only to the 
“international uses of Al”*? but also to the international regulatory landscape relevant 
to such uses. To minimize the risk of international fragmentation, agencies should be 
directed to ensure regulations minimize conflicts with risk-based approaches 
implemented by key US trading partners and allies. Specifically, the Draft Guidance 
should require agencies to evaluate the international regulatory landscape as part of 
the “Regulatory Impact Analysis” outlined in Appendix A. For instance, in performing 
a cost-benefit analysis on potential regulatory approaches, a preference should be 
given to options that are interoperable with similar policies in foreign markets. 


3. Ensure that Policies Target the Appropriate Al Stakeholders 


The Draft Guidance sets out a risk-management based approach to Al governance, directing 
agencies to ensure regulations are “appropriate to, and commensurate with, the degree of 
risk” posed by specific Al applications.*4 As noted above, the Draft Guidance’s focus on 
particular applications of Al will encourage the development of policies that are informed by 
context-specific risk assessments that target harms and outcomes as opposed to broad 
categories of technologies. 


e Recommendation 5: The Draft Guidelines can build on this risk-management 
approach by directing agencies to ensure that regulatory efforts account for the 
unique roles and capabilities of the range actors that may be involved in an Al 
system’s supply chain. As a general principle, the Draft Guidelines should ensure that 
regulatory obligations (and associated liabilities) fall on the actor that is best 
positioned to both identify and efficiently mitigate the risk of harm that gave rise to the 
need for a regulation. In many circumstances, only the entity that has deployed an Al 
system will be in a position to monitor whether it is operating as intended and 
intervene when necessary to mitigate risk. 


4. Support the Development of a Non-Regulatory Risk Management Framework 


We agree that non-regulatory policy approaches — including sector-specific frameworks and 
voluntary consensus standards — can play a critically important role in promoting reliable, 


10 See, e.g., European Commission Al White Paper at pg. 10 (“[T]here is a need to examine whether 
current legislation is able to address the risks of Al and can be effectively enforced, whether adaptations 
of the legislation are needed, or whether new legislations is needed.”) 


11 Id. at pg. 17 (“As a matter of principle, the new regulatory framework for Al should be effective to 
achieve its objectives while not being excessively prescriptive so that it could create a disproportionate 
burden, especially for SMEs. To strike this balance, the Commission is of the view that it should follow a 
risk-based approach.”) 


12 Regulatory efforts will focus on “high-risk Al applications.” 
13 Draft Guidance at pg. 5. 
14 Draft Guidance at 13. 
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robust, and trustworthy Al applications. The National Institute of Science and Technology 
should play a leading role in the development of a voluntary framework for managing the 
risks to trustworthy Al, as it has in the context of cybersecurity and privacy. Such a process 
would bring together experts from government, industry, and academia to develop a 
framework for identifying and mitigating risks that can emerge as Al systems are designed, 
developed, and deployed. An Al risk management framework would be valuable not only for 
companies that are developing and using Al technologies with the potential to impact the 
public, but also for agencies as they are creating Al policy. 


e Recommendation 6: The Draft Guidance should include “voluntary risk management 
frameworks” as an example in the “Non-Regulatory Approaches to Al” section. 


The Draft Guidance outlines a thoughtful approach to Al governance. We agree that the goal 
of Al governance should be to promote innovation and enhance public trust. Achieving these 
objectives will require a policy environment that provides clarity for businesses seeking to 
adopt Al and certainty for consumers that existing legal safeguards will continue to apply to 
their interactions with Al. We look forward to working with OMB and the agencies on the 
implementation of the Draft Guidance. 


Sincerely, 


Christian Troncoso 
Senior Director, Policy 
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